{"abstract":"Origin form forwarding retains path and query.","category":"Proxy forwarding","checks":4,"contract":"Bounded offline decision model: origin form forwarding retains path and query. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.","evaluation_group":"xh-origin-form-forwarding-retains-path-and-query","failed_approach":"The attempted repair uses `urlsplit(url).path or \"/\"` and still violates a separate fixture.","family":"xh-origin-form-forwarding-retains-path-and-query","id":"FA-7041","implementations":{"attempt":{"sha256":"5de1254366a77f30534f9a51ec345d4d1291140cbd3fe3bd77d4449a518698d6","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(url):\n    return urlsplit(url).path or \"/\"\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://h/a?q=1'), '/a?q=1')\", \"check('fixture 2', solve('https://h'), '/')\", \"check('fixture 3', solve('https://h/a#f'), '/a')\", \"check('fixture 4', solve('https://h/?q=x'), '/?q=x')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"9b4627dc6431627819b1ee4e32ddb5fb19895cfd6660fd3e55c4491b366599e7","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(url):\n    return urlsplit(url).path\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://h/a?q=1'), '/a?q=1')\", \"check('fixture 2', solve('https://h'), '/')\", \"check('fixture 3', solve('https://h/a#f'), '/a')\", \"check('fixture 4', solve('https://h/?q=x'), '/?q=x')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"5e75e301ced390282e035e3b68efa45b5a9f57f8830ef420769c42b1fd9b88f8","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(url):\n    return (urlsplit(url).path or \"/\") + (\"?\"+urlsplit(url).query if urlsplit(url).query else \"\")\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://h/a?q=1'), '/a?q=1')\", \"check('fixture 2', solve('https://h'), '/')\", \"check('fixture 3', solve('https://h/a#f'), '/a')\", \"check('fixture 4', solve('https://h/?q=x'), '/?q=x')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-origin-form-forwarding-retains-path-and-query","generated_at":"2026-09-29T14:38:07.806964+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic proxy forwarding model isolates the origin-form-forwarding-retains-path-and-query policy at a network component boundary.","repair":"Apply the explicit origin-form-forwarding-retains-path-and-query contract, including the tested boundary and negative cases.","root_cause":"The faulty implementation uses `urlsplit(url).path` for the origin-form-forwarding-retains-path-and-query decision.","sha256":"479d268bcc8dfd6c2ac5490ae7a834d8e99da9cf1175ae4249ab0a066f1d9e7b","title":"Origin form forwarding retains path and query · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":37.326,"exit_code":1,"observations":[{"actual":"/","check":"fixture 2","expected":"/","passed":true},{"actual":"/a","check":"fixture 3","expected":"/a","passed":true},{"actual":"/","check":"fixture 4","expected":"/?q=x","passed":false},{"actual":"/a","check":"fixture 1","expected":"/a?q=1","passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"/\", \"expected\": \"/\", \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": \"/a\", \"expected\": \"/a\", \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": \"/\", \"expected\": \"/?q=x\", \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": \"/a\", \"expected\": \"/a?q=1\", \"passed\": false}], \"passed\": false}\n"},"broken":{"elapsed_ms":34.097,"exit_code":1,"observations":[{"actual":"","check":"fixture 2","expected":"/","passed":false},{"actual":"/a","check":"fixture 3","expected":"/a","passed":true},{"actual":"/","check":"fixture 4","expected":"/?q=x","passed":false},{"actual":"/a","check":"fixture 1","expected":"/a?q=1","passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"\", \"expected\": \"/\", \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": \"/a\", \"expected\": \"/a\", \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": \"/\", \"expected\": \"/?q=x\", \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": \"/a\", \"expected\": \"/a?q=1\", \"passed\": false}], \"passed\": false}\n"},"fixed":{"elapsed_ms":40.799,"exit_code":0,"observations":[{"actual":"/","check":"fixture 2","expected":"/","passed":true},{"actual":"/a","check":"fixture 3","expected":"/a","passed":true},{"actual":"/?q=x","check":"fixture 4","expected":"/?q=x","passed":true},{"actual":"/a?q=1","check":"fixture 1","expected":"/a?q=1","passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"/\", \"expected\": \"/\", \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": \"/a\", \"expected\": \"/a\", \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": \"/?q=x\", \"expected\": \"/?q=x\", \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": \"/a?q=1\", \"expected\": \"/a?q=1\", \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}